Enable VM insights using Azure Policy

Azure Policy lets you set and enforce requirements for all new resources you create and resources you modify. VM insights policy initiatives, which are predefined sets of policies created for VM insights, install the agents required for VM insights and enable monitoring on all new virtual machines in your Azure environment.

This article explains how to enable VM insights for Azure virtual machines, virtual machine scale sets, and hybrid virtual machines connected with Azure Arc by using predefined VM insights policy initiatives. This ensures that your machines are consistently monitored without requiring manual configuration for each.

Prerequisites

• Before you can enable VM insights using Azure Policy, you need to have a VM insights DCR created. The DCR specifies what data to collect from the agent and how it should be processed. See VM insights DCR for details on creating or downloading this DCR.
• Uninstall the Dependency Agent extension on any machine or scale set that may have it installed if you're going to enable process and dependency collection. The VM Insights initiatives don't update a Dependency agent extension that already exists on your VM with Azure Monitoring agent settings.

VM insights initiatives

VM insights policy initiatives install the Azure Monitor agent and configure data collection for VM insights on virtual machines in the scope of the policy assignment. The Dependency agent is also installed if the option to collect process and dependency data is selected to support the Map feature of VM insights. Assign these initiatives to a management group, subscription, or resource group to automatically install the agents on Windows or Linux Azure virtual machines created in the defined scope. Run a remediation task for the initiative to enable VM insights on existing virtual machines in the scope.

The following VM insights initiatives are available, depending on the type of virtual machine you want to enable:

• Enable Azure Monitor for VMs with Azure Monitoring Agent (AMA)
• Enable Azure Monitor for VMSS with Azure Monitoring Agent (AMA)
• Enable Azure Monitor for Hybrid VMs with AMA

Assign a VM insights policy initiative

To assign a VM insights policy initiative to a management group, subscription, or resource group from the Azure portal, open the Policy menu and then select Assignments > Assign initiative.

The following tabs provide a description for the options available in the tabs of the Assign initiative screen.

Review compliance

After you assign an initiative, you can review and manage compliance for the initiative across your management groups and subscriptions.

To see how many virtual machines exist in each of the management groups or subscriptions and their compliance status:

1. Open Monitor in the Azure portal.

2. Select Insights > Virtual machines > Overview > Other onboarding options. Under Enable using policy, select Enable.

   

   The Azure Monitor for VMs Policy Coverage page appears.

   

   The following table describes the compliance information presented on the Azure Monitor for VMs Policy Coverage page.

   Function	Description
   Scope	Management group or subscription to which the initiative applies.
   My Role	Your role in the scope. The role can be Reader, Owner, Contributor, or blank if you have access to the subscription but not to the management group to which it belongs. Your role determines which data you can see and whether you can assign policies or initiatives (owner), edit them, or view compliance.
   Total VMs	Total number of VMs in the scope, regardless of their status. For a management group, this number is the sum total of VMs in all related subscriptions or child management groups.
   Assignment Coverage	Percentage of VMs covered by the initiative. When you assign the initiative, the scope you select in the assignment could be the scope listed or a subset of it. For instance, if you create an assignment for a subscription (initiative scope) and not a management group (coverage scope), the value of Assignment Coverage indicates the VMs in the initiative scope divided by the VMs in coverage scope. In another case, you might exclude some VMs, resource groups, or a subscription from the policy scope. If the value is blank, it indicates that either the policy or initiative doesn't exist or you don't have permission.
   Assignment Status	Success: Azure Monitor Agent or the Log Analytics agent and Dependency agent deployed on all machines in scope. Warning: The subscription isn't under a management group. Not Started: A new assignment was added. Lock: You don't have sufficient privileges to the management group. Blank: No VMs exist or a policy isn't assigned.
   Compliant VMs	Number of VMs that have both Azure Monitor Agent or Log Analytics agent and Dependency agent installed. This field is blank if there are no assignments, no VMs in the scope, or if you don't have the relevant permissions.
   Compliance	The overall compliance number is the sum of distinct compliant resources divided by the sum of all distinct resources.
   Compliance State	Compliant: All VMs in the scope have Azure Monitor Agent or the Log Analytics agent and Dependency agent deployed to them, or any new VMs in the scope haven't yet been evaluated. Noncompliant: There are VMs that aren't enabled and might need remediation. Not Started: A new assignment was added. Lock: You don't have sufficient privileges to the management group. Blank: No policy assigned.

3. Select the ellipsis (...) > View Compliance.

   

   The Compliance page appears. It lists assignments that match the specified filter and indicates whether they're compliant.

   

4. Select an assignment to view its details. The Initiative compliance page appears. It lists the policy definitions in the initiative and whether each is in compliance.

   

   Policy definitions are considered noncompliant if:

   • Azure Monitor Agent, the Log Analytics agent, or the Dependency agent aren't deployed. Create a remediation task to mitigate.
   • VM image (OS) isn't identified in the policy definition. Policies can only verify well-known Azure VM images. Check the documentation to see whether the VM OS is supported.
   • Some VMs in the initiative scope are connected to a Log Analytics workspace other than the one that's specified in the policy assignment.

5. Select a policy definition to open the Policy compliance page.

Create a remediation task

If your assignment doesn't show 100% compliance, create remediation tasks to evaluate and enable existing VMs. You'll most likely need to create multiple remediation tasks, one for each policy definition. You can't create a remediation task for an initiative.

To create a remediation task:

1. On the Initiative compliance page, select Create Remediation Task.

   

   The New remediation task page appears.

   

2. Review Remediation settings and Resources to remediate and modify as necessary. Then select Remediate to create the task.

   After the remediation tasks are finished, your VMs should be compliant with agents installed and enabled for VM insights.

Track remediation tasks

To track the progress of remediation tasks, on the Policy menu, select Remediation and select the Remediation tasks tab.

Next steps

Learn how to:

• View VM insights Map to see application dependencies.
• View Azure VM performance to identify bottlenecks and overall utilization of your VM's performance.